CVE-2026-14680

Public on 2026-08-13
Modified on 2026-08-14
Description
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Postgresql14 Extra libpq Not Affected
Amazon Linux 2023 libpq Not Affected
Amazon Linux 2 - Core postgresql Pending Fix
Amazon Linux 2 - Postgresql14 Extra postgresql Pending Fix
Amazon Linux 2023 postgresql15 Pending Fix
Amazon Linux 2023 postgresql16 Pending Fix
Amazon Linux 2023 postgresql17 Pending Fix
Amazon Linux 2023 postgresql18 Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H